How can HTTP be Secure?

12bdebt3

Paul_Varjak wrote: »

My Bills Online is not just a service for water companies. If someone can grab a couple of bills from different companies, he is well on his way to stealing your identity!

Bit of a sexist comment not all hackers are male, just the best ones.

Plus if a hacker really wanted your credentials or your water bill I doubt HTTPS would stop he/she if he/she is good enough at hacking.

jaydeeuk1

To be fair, if they're able to hack the https protocol and encryption algorithm, I'll sure they'll have better and more lucrative targets than some family's water bill website.

Paul_Varjak

RobTang wrote: »

You could spike the original request and redirect in a man in the middle request, your suspectable to it anyway if you dont explictly goto the https address.

Although My Bills On line does only allow for viewing of bills, there are links on the insecure web page to internet banking for three banks. A Man-in-the-Middle attack could easily redirect those banking links. Users would not receive any certificate error since the My Bills Online page is not secure anyway!

RobTang

Paul_Varjak wrote: »

Although My Bills On line does only allow for viewing of bills, there are links on the insecure web page to internet banking for three banks. A Man-in-the-Middle attack could easily redirect those banking links. Users would not receive any certificate error since the My Bills Online page is not secure anyway!

Personally its irrelevant, if I sit in the middle of your connection I can redirect any address you happen to type in why would I bother to create a fake page which has a link you may or may not click when I Can just re-direct the original url from anywhere.

You may as well compain all the banks landing pages are http as well which is why some like to use the rapport software.

Paul_Varjak

RobTang wrote: »

You may as well compain all the banks landing pages are http as well which is why some like to use the rapport software.

The landing pages of banks may well be HTTP but the log-in pages are not. With My Bills Online, the landing page is the log-in page.